Field device for determining or monitoring a physical or chemical, process variable

ABSTRACT

A field device for determining or monitoring a physical or chemical, process variable, comprising: a sensor, which works according to a defined measuring principle; and a control/evaluation unit. The control/evaluation unit is realized on a partially dynamically reconfigurable FPGA component, which is constructed from a plurality of FPGA blocks units. Each FPGA block unit comprises a plurality of logic blocks. Global resources or global function blocks are associated with each FPGA block unit or groups of FPGA block units. At least a first section and a second section are provided on the FPGA-component. The sections comprise FPGA block units and corresponding global resources global function blocks. In each section a digital measuring path comprising a plurality of software based and/or hardware based, function modules, is partially dynamically reconfigurable.

The invention relates to a field device for determining or monitoring aphysical or chemical process, variable. Preferably, the field device isapplied in automation technology, especially in process andmanufacturing automation. In connection with this, reference is made toWO 2004/013585 A1, from which a solution is already known, whichespecially concerns an embodiment of a field device, which can beapplied in a safety critical application in process automation. Inprinciple, however, the invention is not limited to process andmanufacturing automation, but, instead can also be applied in safetycritical applications in the automobile sector, etc.

In the following, automation technology is described in somewhat greaterdetail: Field devices, which serve for determining and monitoringprocess variables, are applied in automation technology, especially inprocess automation technology. Examples of such field devices are filllevel measuring devices, flow measuring devices, analytical measuringdevices, pressure and temperature measuring devices, humidity andconductivity measuring devices, density and viscosity measuring devices.The sensors of these field devices register the corresponding processvariables, e.g. fill level, flow, pH value, substance concentration,pressure, temperature, humidity, conductivity, density or viscosity.

However, the term ‘field devices’ also encompasses actuators, e.g.valves or pumps, via which, for example, the flow of a liquid in apipeline or the fill level in a container can be changed. A large numberof such field devices are available from the firm, Endress+Hauser.

As a rule, field devices in modern automation technology plants as wellas in the automobile sector are connected to a superordinated unit viacommunication networks such as HART Multidrop, point to pointconnection, Profibus, Foundation Fieldbus, CAN bus; the superordinatedunit is referred to as a control system or superordinated control unit.This superordinated unit serves for control, diagnosis, visualization,monitoring, as well as for the start up and servicing of the fielddevices. Supplemental components necessary for the operation of fieldbussystems, directly connected to a fieldbus and serving especially forcommunication with the superordinated units, are likewise frequentlyreferred to as field devices. These supplemental components include e.g.remote I/Os, gateways, linking devices, controllers, wireless adapters,etc. These also fall under the terminology, ‘field devices’.

The software fraction of field devices is steadily increasing. Theadvantage in the use of intelligent field devices (smart field devices)controlled by microcontrollers is that a large number of differentfunctionalities can be implemented in a field device using applicationspecific, software programs; program changes can also be made relativelysimply. On the other hand, the high flexibility of program controlled,field devices is countered by having a relatively low processing speedand therewith a correspondingly low measuring rate as a result of thesequential progression through the program.

In order to increase the processing speed, ASICs—Application SpecificIntegrated Circuits—are used in field devices, when it is economicallyjustifiable. Through an application specific configuration, these chipscan process data and signals significantly faster than a softwareprogram. Consequently, ASICs are especially excellently suitable forcomputationally intensive applications.

Disadvantageous in the case of ASICs is that their functionality isfixed after creation. Subsequent change of the functionality of thesechips is not readily possible. Furthermore, the use of ASICs pays offonly with relatively large piece numbers, since the developmental effortand the costs connected therewith are high.

A configurable field device, in which a reconfigurable logic chip in theform of an FPGA is provided, in order to avoid the drawback of fixedfunctionality, is known from WO 03/098154 A1. In this known solution,the logic chip is configured with at least one microcontroller, which isalso referred to as an embedded controller, at system startup. After theconfiguration is finished, the required software is loaded in themicrocontroller. The reconfigurable logic chip here required must makeuse of sufficient resources, namely logic, wiring and memory resources,in order to fulfill the desired functionalities. Logic chips with manyresources require much energy, which, in turn, makes its use inautomation only limitedly possible from a functional point of view. Adisadvantage in the use of logic chips with few resources and, thus,with lower energy consumption is the occasionally considerablelimitation in the functionality of the corresponding field device.

Depending on application, field devices must satisfy the most varied ofsafety requirements. In order to satisfy relevant safety requirements,e.g. the SIL-standard ‘security integrity level’, which plays a largerole in process automation, the functionality of the field devices must,moreover, be redundantly and/or diversely designed.

Redundancy means increased safety through the doubled or multipledesigning of all safety relevant, hardware and software components.Diversity means that the hardware components, such as e.g. amicroprocessor or an A/D converter, located in the different measuringpaths come from different manufacturers and/or that they are ofdifferent types. In the case of software components, diversity requiresthat software stored in the microprocessors originate from differentsources, e.g. different manufacturers or programmers. Through all thesemeasures, it should be assured that a safety critical failure of thefield device as well as the occurrence of simultaneously arisingsystematic errors in the measured value are excluded with highprobability. Supplementally, it is also known to design individualessential hardware and software components of the evaluating circuitredundantly and/or diversely. The redundant and diverse design ofindividual hardware and software components can further increase thedegree of safety.

An example of a safety relevant application is monitoring fill level ina tank, in which a burnable, explosive liquid, or also a non combustibleliquid that is endangering to the environment, is stored. Here it mustbe assured that the supply of liquid to the tank is immediatelyinterrupted as soon as a maximum reliable fill level is achieved. This,in turn, requires that the measuring device detects the fill level withhigh reliability and works faultlessly.

A field device is known from WO 2009/062954 A1 that has a sensor, whichworks according to a defined measuring principle, and acontrol/evaluation unit, which conditions and evaluates the measurementdata delivered by the sensor along at least two equal measuring paths asa function of a safety standard required in the respective safetycritical application. The control/evaluation unit is at least partiallyembodied as a reconfigurable logic chip with a plurality of partiallydynamically reconfigurable function modules. The control/evaluation unitconfigures the function modules in the measuring paths as a function ofthe defined safety critical application in such a manner that the fielddevice is correspondingly designed to fulfill the required safetystandard.

Problematic in the case of the known embodiment is that a malfunction,e.g. a short circuit or a temperature change, in one sectionautomatically influences other sections. There is crosstalk to othersections, so that the field device can deliver defective measurementresults and no longer works reliably. This presents a high risk,especially in safety critical applications, which is not acceptable.

The not pre-published DE 10 2010 002 346.9, filed on Feb. 25, 2010,describes a field device, in which the control/evaluation unit isrealized on a single FPGA chip. A standard FPGA chip is utilized. Insuch case, at least a first section and a second section are provided onthe FPGA chip. In each section, a digital measuring path is partiallydynamically reconfigurable; the measuring path comprises a plurality ofsoftware based and/or hardware based function modules. The individualsections are isolated from one another by permanently configured spacingregions or forbidden regions, wherein the spacing regions are embodiedso that a temperature and/or a voltage change in one of the sectionsdoes not influence the other section or the other sections and that noconnection arises between the sections in the case of malfunction. Thecontrol/evaluation unit partially dynamically reconfigures the functionmodules in the measuring paths as a function of each defined safetycritical application in such a manner that the field device fulfills therequired safety standard. ‘Partially dynamically reconfigurable’ meansthat the function modules of the FPGA in the corresponding measuringpath are reconfigured during run time, i.e. dynamically. This isespecially important when a malfunction occurs. One such malfunction isbrought about, for example, by incoming gamma or cosmic radiation, thushigh energy radiation, which changes or shuts down the functioning ofone or a plurality of logic blocks or logic components or otherresources.

An object of the invention is to provide a highly flexible field devicefor use in safety critical applications.

The object is achieved by a field device comprising: A sensor, whichworks according to a defined measuring principle; and acontrol/evaluation unit. The control/evaluation unit is realized as apartially dynamically reconfigurable FPGA component constructed of aplurality of FPGA block units, wherein each FPGA block unit comprises aplurality of logic blocks and wherein global resources or globalfunction blocks are associated with each FPGA block unit or with adefined group of FPGA block units. At least a first section and a secondsection are provided on the FPGA component; the sections comprise FPGAblock units and corresponding global resources or global functionblocks. In each section a digital measuring path comprising a pluralityof software based and/or hardware based function modules, is partiallydynamically reconfigurable. The global resources or global functionblocks are DCMs, i.e. Digital Clock Managers, global wiring, clock orconfiguration resources and/or inputs/outputs. Furthermore, the globalresources can also be memory chips (RAMS) and multipliers. The resourcesnamed last are not absolutely necessary.

In an advantageous embodiment of the field device of the invention, itis provided that wiring for the transmission of data and/or signals isprovided between the FPGA block units. In this way, it is possible toconnect a number of block units suitably with one another, whereby morecomplex functions are implementable.

An advantageous embodiment provides that the control/evaluation unitpartially dynamically reconfigures the FPGA block units, preferablythrough function modules in the measuring paths or in the sections, as afunction of a defined safety critical application, so that the fielddevice fulfills a required safety standard. For example, the safetystandard is the standard IEC61508 (Edition 2).

In order to achieve a defined isolation of the sections, the individualsections are isolated from one another by spacing regions, wherein thespacing regions comprise FPGA block units with corresponding globalresources or global function blocks. Originally, an FPGA componentcomprises a plurality of FPGA block units, which are then connectedtogether to build sections. The sections on the FPGA component formislands insulated from one another, whereby no mutual influencingoccurs.

Preferably, the spacing regions are so embodied that a potentialisolation between the sections is achieved in such a manner that atemperature and/or a voltage change in one of the sections has noinfluence on a neighboring section or the neighboring sections and thatno connection between the sections occurs in the case of a malfunction.In such case, the dimensions of the spacing regions used for potentialisolation is dependent on the dimensions of the FPGA block units,wherein a spacing region has at least the width of an FPGA block unit.In any case, the width of the spacing regions is so selected that shortcircuiting or crosstalk between sections is excluded. Furthermore, thespacing regions serve for thermal decoupling of the sections. Thegranularity, i.e. the size of the islands, is lastly a compromisebetween overhead, wherein especially the configuration resources areunderstood to be among this, and the degree of flexibility. Flexibilitymeans that the user can freely define the size of the groups of blockunits, or sections, during the developmental phase and, by payingattention to certain rules, also during operation of the field device.

An advantageous further development of the field device of the inventionprovides that the logic blocks, the global resources or global functionblocks, as well as the corresponding wiring arranged in each spacingregion are connected to ground or are blocked externally by turning offthe electrical current supply.

As a function of the safety regulations present, the measuring pathshaving the partially dynamically reconfigurable function modules aredesigned redundantly, diversely, or redundantly and diversely.

Furthermore, it is provided that associated with the control/evaluationunit is a voter or microcontroller, which is likewise isolated from theneighboring measuring paths by spacing regions and which compares witheach other the measurement data made available by, or in, the measuringpaths and corresponding to one another, and, in the case of a deviation,generates a warning and/or an error report. Preferably, the voter ormicrocontroller is arranged in an FPGA block unit.

In an advantageous form of embodiment of the field device of theinvention, it is provided that the voter or microcontroller partiallydynamically reconfigures the function modules for an odd number ofredundant and or diverse measuring paths serially or in parallel,wherein the voter or microcontroller compares the measurement data madeavailable by or in the measuring paths with one another, and wherein thevoter or microcontroller generates a warning report that a definedmeasuring path is delivering defective data when measurement data madeavailable by the defined measuring path deviates from the measurementdata of the remaining measuring paths. In the case of a malfunction, itis possible to determine in which measuring path the error occurred withthis embodiment.

Moreover, it is provided that a static region, isolated from neighboringsections by spacing regions is provided on a selected section of theFPGA; at least one function module, in which the control program for theconfiguration of the function modules to be dynamically configured inthe individual sections runs, is permanently configured in the staticregion.

An advantageous embodiment of the field device of the invention providescommunication lines, which are arranged outside of the FPGA component.Furthermore, at least one limiting apparatus to limit voltage and/orelectrical current between the sections is provided in the individualcommunication lines.

It is seen as especially advantageous in connection with the presentinvention when at least some of the global resources or global functionblocks are associated with a plurality of FPGA block units.

Thus, a global resource or a global function block for electricalcurrent/voltage supply is preferably associated with a plurality of FPGAblock units. The corresponding supply lines are dividable as much asdesired by interposing electrical or electronic isolating elements.

Moreover, it is provided that the control/evaluation unit partiallydynamically reconfigures the FPGA block units in the sections or in themeasuring paths and the corresponding spacing regions as a function ofthe respective application.

Furthermore, in the case of a safety critical application, it isprovided that the control/evaluation unit performs the partially dynamicreconfiguration such that the individual sections are isolated from oneanother at all times by at least one spacing region.

The invention will now be explained in greater detail based on theappended drawing, the figures of which show as follows:

FIG. 1 a representation of an FPGA component known from the state of theart,

FIG. 2 a representation of an embodiment of the FPGA component of theinvention,

FIG. 3 by way of example, a particular embodiment of the

FPGA component of the invention for a safety critical application,

FIG. 4 a block diagram for wiring the supply voltage, and

FIG. 4 a section A from FIG. 4.

FIG. 1 shows a representation of an FPGA component 1 known from thestate of the art; the FPGA component is embodied to be partiallydynamically reconfigurable. A plurality of reconfigurable logic blocks 5are arranged on the component 1. Furthermore, global resources, such asa central voltage supply 6, a number of clock resources 7, so calledDigital Clock Managers, and configuration resources 8 are to be found onthe FPGA component 1. Furthermore, resources such as multipliers and/ormemory elements 17 and inputs/outputs 18 are arranged on the FPGAcomponent 1.

FIG. 2 shows a representation of an embodiment of the FPGA component 1of the invention. While the logic blocks 5 are essentially homogeneouslyarranged on the FPGA component 1 shown in FIG. 1, the FPGA component 1of the invention has a plurality of FPGA block units 2, in which thelogic blocks 5 are arranged in islands largely separated from oneanother. The block units 2 each have a separate voltage supply 6,dedicated clock resources 7, such as DCM, global connecting lines,dedicated configuration resources 8, such as JTAG, configuration linesand dedicated inputs/outputs 18. These resources are referred to asglobal resources 6, 7, 8 in connection with the invention. Additionally,optionally, there are dedicated, less important global resources, suchas multipliers/memory elements 17, etc. As already described above, theglobal resources 6, 7, 8 can also be associated with a group of blockunits 2. Such an embodiment can make sense, depending on application.

FIG. 3 shows, by way of example, a concrete embodiment of the FPGAcomponent 1 of the invention for a safety critical application. In thecase illustrated, the FPGA component 1 is divided into four sections3.1, 3.2, 3.3, 3.4. Section 3.1 is embodied as a static region 15.Preferably the microcontroller or voter 11 is configured permanentlyhere. The individual redundant and/or diverse measuring paths MP1, MP2,MP3 are partially dynamically reconfigured in sections 3.2, 3.3, 3.4. Insuch case, partially means that only individual function modules FM inone of the measuring paths MP1, MP2, MP3 can be reconfigured.

The individual block units 2 are isolated from one another by spacingregions 4.1, 4.2, 4.3, 4.4. The spacing regions 4.1, 4.2 . . . are soembodied that a potential isolation between the sections 3.2, 3.3 . . .is achieved. This is done in such a manner that a temperature and/or avoltage change in one of the sections MP1, MP2 . . . has no influence ona neighboring section or neighboring sections and that no connectionbetween the sections MP1, MP2, MP3 arises in the case of malfunction.Especially, the dimensions of the spacing regions 4.1, 4.2 . . .installed for potential isolation are dependent on the dimensions of theFPGA block units 2. In FIG. 3, the width of the spacing regions 4.1, 4.2. . . corresponds to each individual FPGA block unit 2. As described inFIG. 2, each block unit 2 or a group of block units 2 possesses globalresources 6, 7, 8. In order to achieve a safe isolation between thesections 3.1, 3.2 . . . , the spacing regions 4.1, 4.2 . . . in theregion of the block units 2 are insulated, or supplied, from the voltagesupply 6 and connected to ground or correspondingly configured. Inconnection with the field device of the invention, it is possible toreconfigure or partially reconfigure individual measuring paths MP1, MP2. . . during operation of the field device. In such case, however, inthe case of use in a safety critical application, it must be heeded thatthe safety separation, e.g. the corresponding spacing regions 4.1, 4.2 .. . are always configured first in the case of a change of thedimensions of a measuring path MP1, MP2 . . . .

Furthermore the communication between the FPGA sections 3.1, 3.2 . . .or the measuring paths MP1, MP2 occurs externally and is protected byresistors 19.

As already mentioned above, it is possible to associate the globalresources 6, 7, 8 with a variable number of block units 2, depending onapplication. This is made possible in that at least one global resource6, 7, 8, or one global function block, is present for the supply ofelectrical current/voltage and/or a clock signal and/or for theconfiguration of a plurality of FPGA block units 2. The correspondingsupply lines (and/or clock lines and/or configuration lines—the latterare not separately shown in FIG. 4 and FIG. 4 a) are dividable as muchas desired by interposing electrical or electronic isolating elements16. The isolating elements 16 are, for example, transistors.

Shown in FIG. 4 is a block diagram for the wiring 14 of the supplyvoltage 6. The supply lines 13 are not allowed to cross and,consequently, in given cases, are arranged in different planes of theFPGA component 1. FIG. 4 a shows an enlargement of section A in FIG. 4.As there are, supply lines 13 for the supply voltage 6, so there areseparate lines for the additional global resources 7, 8, which canlikewise be switched in and out individually or in groups with isolatingelements 16, to the extent desired.

List of Reference Characters

1 FPGA component

2 FPGA block unit

3.n section

4.n spacing region

5 logic block

6 global resource for electrical current/voltage supply

7 global resource for clock signal

8 global resource for configuration

10 control/evaluation unit

11 voter or microcontroller

12 communication line

13 supply line

14 wiring

15 static region

16 isolating element

17 multiplier/memory chip

18 input/output

19 resistor

1. A field device for determining or monitoring a physical or chemical,process variable, comprising: a sensor, which works according to adefined measuring principle; and a control/evaluation unit, saidcontrol/evaluation unit is realized on a partially dynamicallyreconfigurable FPGA component, which is constructed from a plurality ofFPGA block units; each FPGA block unit comprises a plurality of logicblocks; global resources or global function blocks are associated witheach FPGA block unit or groups of FPGA block units, wherein: at least afirst section and a second section are provided on said FPGA component,which sections comprise FPGA block units and corresponding globalresources or global function blocks; and in each section a digitalmeasuring path comprising a plurality of software based and/or hardwarebased, function modules, is partially dynamically reconfigurable.
 2. Thefield devices as claimed in claim 1, wherein: wiring is provided for thetransmission of data and/or signals between said FPGA block units. 3.The field device as claimed in claim 1, wherein: said control/evaluationunit partially dynamically reconfigures said function modules in themeasuring paths, or in the sections as a function of a defined safetycritical application, so that the field device fulfills a requiredsafety standard.
 4. The field device as claimed in claim 1, wherein:said individual sections are isolated from one another by spacingregions; and said spacing regions comprise FPGA block units (2) withcorresponding global resources (6, 7, 8) or global function blocks. 5.The field device as claimed in claim 4, wherein: said spacing regionsare so embodied that a potential isolation between said sections isachieved in such a manner that a temperature and/or a voltage change inone of the sections has no influence on a neighboring section orneighboring sections and that no connection between the sections occursin the case of malfunction.
 6. The field device as claimed in claim 4,wherein: the dimensions of said spacing regions, installed for potentialisolation, are dependent on the dimensions of said FPGA block units andhave at least the width of said FPGA block unit.
 7. The field device asclaimed in of claim 2, wherein: said logic blocks, said global resourcesor said global function blocks as well as said corresponding wiringarranged in each spacing region are connected to ground or are blockedexternally by the turning off of the electrical current supply.
 8. Thefield device as claimed in claim 1, wherein: said measuring paths withthe partially dynamically reconfigurable function modules are designedredundantly, diversely, or redundantly and diversely.
 9. The fielddevice as claimed in claim 1, wherein: associated with saidcontrol/evaluation unit is a voter or microcontroller, which is likewiseisolated from the neighboring measuring paths by spacing regions; saidvoter or microcontroller compares measurement data made available by orin said measuring paths and corresponding to one another with eachanother and generates a warning or error report in the case of adeviation.
 10. The field device as claimed in claim 1, wherein: saidvoter or microcontroller partially dynamically reconfigures saidfunction modules for an odd number of redundant and or diverse measuringpaths serially or in parallel; said voter or microcontroller comparesthe measurement data made available by or in said measuring paths withone another; and said voter or microcontroller generates a warningreport that a defined measuring path is delivering defective data whenmeasurement data made available by said defined measuring path deviatesfrom measurement data of the remaining measuring paths.
 11. The fielddevice as claimed in claim 1, wherein: a static region, which isisolated from the neighboring sections by spacing regions, is providedon a selected section of said FPGA; and at least one function module, inwhich the control program for configuring said function modules to bedynamically configured in said individual sections runs, is permanentlyconfigured in said static region.
 12. The field device as claimed inclaim 1, wherein: communication lines are provided, which are arrangedbetween the sections outside of said FPGA component.
 13. The fielddevice as claimed in claim 12, further comprising: at least one limitingapparatus in the individual communication lines for limiting voltageand/or electrical current between said sections.
 14. The field device asclaimed in claim 1, wherein: at least some of the global resources orglobal function blocks are associated with a plurality of said FPGAblock units.
 15. The field device as claimed in claim 14, wherein: atleast one global resource or global function block for electricalcurrent/voltage supply and/or for the clock signal and/or forconfiguration is associated with a plurality of said FPGA block units;and the corresponding supply lines and/or clock lines and/orconfiguration lines are dividable as much as desired by interposingelectrical or electronic isolating elements.
 16. The field device asclaimed in claim 1, wherein: said control/evaluation unit partiallydynamically reconfigures said FPGA block units in said sections or insaid measuring paths and the corresponding spacing regions as a functionof the respective application.
 17. The field device as claimed in claim16, wherein: in the case a safety critical application, saidcontrol/evaluation unit performs the partially dynamic reconfigurationsuch that the individual sections are isolated from one another at alltimes by at least one spacing region.